Switching method, device and system

Abstract

The invention provides switching method, device and system, wherein the switching method comprises the following steps: a target AP receives an authentication request frame sent from a user terminal and carrying an EAP starting reauthentication package and sends the EAP starting reauthentication package carried by the authentication request frame to an ERP server; the target AP acquires a reauthentication main session key and an EAP ending reauthentication package from a data package sent from the ERP server and sends an authentication response frame carrying the EAP ending reauthentication package; the target AP receives a reassociated request frame sent from the user terminal and sends a reassociated response frame to the user terminal; and the target AP uses the reauthentication main session key to derive a key used for realizing data communication with the user terminal after successful switching. The technical scheme of the information not only ensures key safety and less authentication delay, but also reduces the cost on key management and avoids network size limitation and other problems, thereby realizing quick and safe switching.

Description

technical field [0001] The invention relates to the technical field of communication, in particular to switching technology. Background technique [0002] The Wireless Local Area Network (WLAN, WLAN) technology has gradually been widely used due to its advantages of high data transmission rate and easy deployment. In the process of large-scale popularization of WLAN technology, the security and authentication delay in the handover process of user terminals, that is, WLAN UE (WLAN User Equipment, hereinafter referred to as UE) have attracted much attention. [0003] The current handover method is: after the UE completes the first Extensible Authentication Framework (EAP) authentication in the mobile domain, the UE and the Home AAA Server (home domain AAA server, HAAA) each generate a Master Session Key (master session key) key, MSK), the initial access Access Point (access point, AP) receives the MSK sent by HAAA. The initial access AP and UE use MSK to derive Pairwise Mast...

AI Technical Summary

Problems solved by technology

[0004] The inventor found that: since each AP may participate in the management of the master session key, the key management of this method is very complicated, and the key management overhead is large; since the PMK-R1 is distributed by the initial access AP, not by the AAA server Therefore, in order to ensure the safe distribution of PMK-R1, it is necessary to establish a security association between two APs, so there may be a situation where a security association needs to be established between any two APs, which limits the network scale

In addition, because the physical security of the AP is usually difficult to guarantee, there is a risk in pushing down the root key, that is, the MSK, to the AP. If the root key is leaked because the AP is compromised, all derived keys will be leaked

Images